Welcome to Manta’s terms and conditions of sale. This document (the “GTC”) is a contract setting out the conditions of sale of the services offered through the website accessible at the URL https://manta.fund (the “Site”).

It is entered into between MNT, a société par actions simplifiée (simplified joint-stock company) with share capital of €5,000, registered with the Paris Trade and Companies Register (RCS) under number 100 098 490, with its registered office at 19, rue des Archives, 75004 Paris, which operates the Site (“Manta”, “we” or “us” and their derivatives), and you, the person who has accepted these GTC (“you” and its derivatives), we and you being collectively referred to as the “Parties”.

1. Acceptance of the GTC

The GTC govern your subscription (the “Subscription”) to the Site and the use of the services we offer through it (the “Services”).

Subscribing is reserved for persons who:

act within the scope of their professional activity (commercial, industrial, craft, professional or agricultural), so that consumer law does not apply to this contractual relationship; and
have full legal capacity to enter into commitments or, where applicable, can provide valid written authorization from their legal representative. In the case of an Organization (as defined in Article 4), the person signing the Purchase Order is deemed to have authority to bind the Organization and to receive updates to the Terms of Use and the GTC in the name and on behalf of their Organization.

The Parties:

acknowledge that the Contract is concluded in the form of an electronic writing, in accordance with the provisions of Article 1366 of the French Civil Code, and validated by ticking the dedicated checkbox when the Account is created or, where applicable, signed electronically by means of a reliable identification process guaranteeing the link between each signature and the Contract to which it relates, in accordance with the provisions of Article 1367 of the French Civil Code;
acknowledge that the Contract has the same evidential value as a writing on paper in accordance with Article 1366 of the French Civil Code and that it may be validly relied upon against them.

2. Services

2.1. Unless otherwise stated in the GTC or the Purchase Order, a Manta Subscription includes all of the following Services:

Document upload : In order to add a new transaction to your portfolio, you must upload one or more documents to Manta. Documents are understood to mean any file and content, in any form whatsoever (.pdf, .jpeg, .docx, .excel, etc., within the limit of accepted file formats), uploaded to the platform by a User (the “Documents”).
Document storage : Manta stores all the Documents and makes them accessible from your document library.
Information extraction from Documents : This generative artificial intelligence feature makes it possible, in particular but not exclusively, to: create your transactions, build your portfolio, create tasks to be completed, list the commitments to be tracked.
Access to external documents : Manta lets you access a number of documents and pieces of information relating to your partners’ companies (articles of association, minutes of general meetings, financial statements, etc.) and their directors.
Bank account connection : At your Organization’s request, Manta can connect to the bank accounts of your companies and those of your partners to allow you to track and map cash flows.
History tracking : Manta tracks and records all additions and changes made from your workspace.
Anomaly detection : Manta detects anomalies between the various Documents of a single transaction uploaded at different times.
Notifications : Manta sends you notifications, in particular but not exclusively, in the following cases: detection of an anomaly, change in the status of a task, addition of a new document, modification of an item, retrieval of external data that might be of interest to you.
Workflow management : Manta automatically creates tasks and allows you to add them, assign them, move them and insert comments into them.
Commitment tracking : Manta extracts from your Documents the various commitments made by your partners so that you can ensure they are complied with.
Reporting : Manta allows your partners to communicate to you all the information relating to your transactions by e-mail or through a dedicated workspace.
Risk : Manta analyses your transactions and assigns them a proprietary risk score.
Search engine : Manta has developed a high-performance search engine using artificial intelligence techniques to search for a document using natural language.
The June AI agent : Manta has developed an AI Agent named June which, using artificial intelligence techniques, allows you to converse with your portfolio and your Dataroom to extract information and perform actions.
Manta guidance : This service comprises three services dedicated to getting the most out of our Services. Manta training : We train you to use our Services tailored to the needs of your organisation. This training, provided throughout your subscription, includes not only the initial product training but also the monitoring of its proper use over the long term and the learning of new features. Manta support : We help you use our Services, in particular through a dedicated Slack or Microsoft Teams channel, through the information tooltips present on the Site, and through the June AI assistant.

2.2. To benefit from the Services, you must create an account (an “Account”), read and accept these GTC and, unless otherwise specified, belong to an Organization that has subscribed to a Subscription for you.

2.3. The Services evolve regularly and are constantly improved and corrected by Manta, which regularly develops new features. We will give you fifteen (15) days’ notice in the event of the removal or major modification of a Service described above. New features may be subject to pricing as part of additional options subject to your agreement.

2.4. Our Services are standardised and are not subject to bespoke development. Consequently, we cannot guarantee that they will exactly meet your needs and expectations. We are at your disposal to provide you with any additional information you may need before deciding to use our solutions.

2.5. Manta may offer services in other languages and intended for other countries, in particular through other websites. The Subscription taken out only gives access to the Services listed above provided on the Site.

2.6. Manta reserves the right to limit access to certain Services for trial Accounts and for persons benefiting from complimentary access not included in a Subscription. These restrictions may concern, without limitation, access to certain generative AI features or the volume of documents that can be uploaded.

3. Registration and Account

3.1. Creating an Account requires the communication of certain information, collected and stored in accordance with the terms detailed in our Data Policy.

As the information provided is used in particular for the invoicing of our Services, you undertake to provide us with accurate and truthful information and to keep it up to date through the administration page of your Account. You can access your account administration area at any time by going to the page https://app.manta.fund/account. Registering under a false name, identity theft, and registering with false contact details, generic contact details or a false professional status are strictly prohibited. We reserve the right to suspend your Account and access to the Services without compensation or refund if it turns out that you are breaching these rules. Accounts provided outside a Subscription may be suspended at any time.

3.2. Your Account is exclusively personal and individual, in particular to ensure the relevance and personalisation of our Services. Consequently, you undertake to create only one Account, to use the Services exclusively personally and never to allow a third party to use them in your place or on your behalf, failing which you bear full responsibility for it. We reserve the right to suspend your Account and access to the Services without compensation or refund in the event of failure to comply with this rule, established in particular in view of an abnormally high use of our Services or of actions carried out with the Account from several different devices within a very short period of time.

3.3. Likewise, you are responsible for maintaining the confidentiality of your login credentials, and in particular of your password. You must contact us immediately if you notice that your Account has been used without your knowledge, in which case we are free to take all appropriate measures to restore the integrity of your Account. Any use of your Account following an identification using your password will be deemed to come from you and will be your responsibility, unless you have previously notified us of a potential login anomaly.

4. Subscription

4.1. The Services are subject to invoices that are made available to you in the “My account” tab on the Site or by email. All Subscriptions begin upon receipt of the first invoice.

4.2. Subscriptions are systematically subject to a Purchase Order.

4.3. The organisation of which you are a member or an entity of the same group (the “Organization”) must take out an annual subscription, tacitly renewable for one-year periods, covering the number of active lines in the portfolio (a “Subscription”). The Subscription may be taken out for a longer term, in which case it is tacitly renewed for that same term and subject to the GTC in force at the time of its renewal.

4.4. The Organization undertakes to report, throughout its Subscription and as soon as possible, any increase in the number of active lines in its portfolio of more than 20%.

4.5. The Subscription is taken out by the Organization for an unlimited number of natural persons, each of whom must create a purely individual and personal Account (the “Users”). Organizations benefit from administrator access enabling them to create Accounts for the chosen Users.

4.6. Negotiation of the terms of commitment is possible with the sales department, which can be reached by email (contact@manta.fund). In all cases, Subscriptions are subject to a purchase order to be completed and returned signed by the Organization (the “Purchase Order”). The Purchase Order specifies the agreed price and any special conditions negotiated by the parties. Any agreed departures from the GTC are valid only for the initial term of commitment. In the event of a contradiction between the Purchase Order and these GTC, the Purchase Order prevails.

4.7. The Purchase Order references these GTC, the provisions of which govern the relationship between Manta and the Organization. Users must also accept and comply with the Terms of Use and the GTC on their first login, which remain applicable individually to each User, it being specified that only the Organization is liable for the payment obligations of its Users.

4.8. In the event of multiple contradictory Purchase Orders, the most recent Purchase Order prevails.

5. Price and Payment Terms

5.1. Price

5.1.1. The prices of our Services are calculated using a progressive tiered scale based on the number of active lines within the Organization’s portfolio. To this are added onboarding fees.

5.1.2. For Subscriptions with a term of one year, in addition to a floor price of €12,000 excluding tax, prices will be calculated according to the following progressive tiered scale, to which onboarding fees are added:

0 to 10 lines — Standard Price: €1,000.00 excl. tax / line — Onboarding: €2,000.00 excl. tax
11 to 50 lines — Standard Price: €750.00 excl. tax / line — Onboarding: €4,000.00 excl. tax
51 to 100 lines — Standard Price: €563.00 excl. tax / line — Onboarding: €6,000.00 excl. tax
101 to 150 lines — Standard Price: €422.00 excl. tax / line — Onboarding: €8,000.00 excl. tax
151 to 200 lines — Standard Price: €317.00 excl. tax / line — Onboarding: €10,000.00 excl. tax
201 to 250 lines — Standard Price: €238.00 excl. tax / line — Onboarding: €12,000.00 excl. tax
+251 lines — Standard Price: €179.00 excl. tax / line — Onboarding: €14,000.00 excl. tax

5.1.3. In the event of monthly payment, the prices indicated above will be increased by 20%.

5.1.4. We reserve the right, at our sole discretion, to offer promotional offers or price reductions. These discounts are valid only for the duration of the initial Subscription.

5.1.5. You are deemed to have read these prices when subscribing to a Subscription. Switching from monthly payment to annualised payment does not result in a change of price. Switching from annualised payment to monthly payment results in the application of a 20% increase in price.

5.1.6. The price will be subject to an annual revision of 8% upon renewal of your Subscription. You remain free to terminate your Subscription under the conditions of Article 6.1 — it will continue to run until its term and will not be renewed — if you do not accept the change in price. Failing that, you are deemed to have accepted the new prices.

5.1.7. VAT at the legal rate in force is applicable to the prices indicated.

5.2. Payment Terms

5.2.1. The total price of each Subscription is paid at the start of the Subscription or of the renewed period, unless otherwise indicated on the Purchase Order.

5.2.2. Payment is made by SEPA direct debit. In the event of annualised payment, it is also possible to pay in a single instalment by bank transfer.

5.2.3. The direct debit is implemented by one of our secure payment providers, which alone retains your payment details: we do not retain any bank details.

5.2.4. You warrant to us that you have the funds and authorisations necessary to use SEPA direct debit. You undertake to take the necessary measures so that the automatic debit of the price of the Services can be carried out, and to inform Manta’s sales department of any change to the information provided when you applied for a subscription, in particular billing details or bank references.

5.2.5. Unless otherwise stated, invoices are payable as soon as they are issued.

5.3. Late Payment and Payment Incidents

5.3.1. We inform you that any delay or incident in the payment of all or part of a sum due automatically entails, without prior formal notice and without prejudice to other actions we may bring:

the immediate suspension of access to the Services until the full payment of all sums due;
the invoicing of late-payment interest at a rate of three times the legal interest rate in force on the date of the order, calculated on the amount of all sums due. Any professional in a situation of late payment is, in addition, automatically liable for an indemnity of €400 for recovery costs.

5.3.2. We also reserve the right to instruct a bailiff to draw up a record of non-payment with a view to a recovery procedure. The costs associated with this record will be borne exclusively by you, without prejudice to the indemnity mentioned that may be claimed.

6. Termination of the Subscription

6.1. Termination by the Organization

6.1.1. Subscriptions (whether payment is monthly or annualised) may be terminated by registered letter with acknowledgement of receipt received no later than three months before the expiry of the current year.

6.1.2. The registered letter with acknowledgement of receipt is deemed to have been presented on the date on which Manta collected it.

6.1.3. Termination of your Subscription under the conditions provided for in the GTC automatically entails the termination of access to all the Services.

6.1.4. Termination does not entail any penalty and does not give rise to a refund of the current period, which runs until its term.

6.2. Termination by Manta

6.2.1. Manta reserves the right to terminate any Subscription without notice, without refund of the sums paid and by any means, in the event of a situation of non-compliance with the Terms of Use or the GTC (and in particular their Articles 3 and 4) that is not rectified following two breach notifications (including by email). In such cases, termination is effective upon receipt of the termination notice.

6.2.3. Manta may choose to refuse the tacit renewal of a Subscription, in particular in the event of an unbalanced commercial relationship, in which case Manta sends notice of its intention no later than one month before the expiry of the current period.

7. Manta’s Obligations

7.1. Confidentiality Undertaking

7.1.1. Manta irrevocably undertakes, except where required by law or by an injunction from the judicial authority, to respect the strictly confidential nature of all Documents and all data transmitted or generated by your use of the Services. Manta refrains, and forbids its employees, from using, allowing the use of, or disclosing to anyone, directly or indirectly, in any form whatsoever, the content of this data.

7.1.2. In particular, Manta undertakes not to train, retrain or fine-tune any artificial intelligence model with this data and these Documents, except where the models thus obtained are intended to be used exclusively by your Organization, or with the prior express written agreement of that Organization authorising Manta to share the models with other Organizations. Manta acknowledges that a breach of this undertaking is likely to engage its liability.

7.1.3. This confidentiality undertaking must not, however, be interpreted as limiting Manta’s ability to provide the Services. Consequently, the actions necessary for the performance, maintenance and evolution of the Services — such as the hosting of data and Documents, the consultation of pseudonymous data on the use of the Services, or the pseudonymous analysis of the use of the Site — comply with this confidentiality undertaking. Indeed, the continuous learning of the Engineering and Product teams during the performance of the Services constitutes for Manta a necessary lever in order to analyse and understand the lessons drawn from your use of the Services and to assess and improve their performance and relevance in light of your needs.

7.2. Insurance

Manta undertakes to take out, with any insurance company of its choice, professional civil liability insurance and any insurance policy of a kind to cover all the risks relating to its activity.

8. Your Other Obligations

Access to the Services is subject to acceptance of the undertakings listed below, which are in addition to the obligations arising from the other clauses of the Terms of Use and the GTC.

8.1. Compliance with Applicable Laws

You undertake to comply with the laws and regulations in force and not to infringe the rights of third parties or public order. In particular, you are solely responsible for the proper completion of all formalities and for all payments of contributions, taxes or duties of any kind incumbent upon you, where applicable, in connection with your use of the Services. Our liability may in no case be sought in this respect.

8.2. Limitations of the Services

You also undertake to take note of the limitations of the Services: you are solely responsible for your use of the Services and for the choice to subscribe to a Subscription. Our liability may in no case be sought if you realise that the Services do not match your needs. We inform you that the use of the Services requires an Internet connection, and that the quality of the Services therefore depends directly on the quality of your connection, for which you are solely responsible.

8.3. Communication

You authorise us, for the duration of your Subscription and for all types of media, to use your corporate name, your trade name and/or your trademarks, solely as a commercial reference for marketing and/or advertising purposes.

9. Availability of Generative AI Services

9.1. In continuation of Article 3 of the Terms of Use, we endeavour, on a best-efforts basis, to maintain access to the Site as well as to the generative AI Services.

9.2. Given the technologies required to provide the generative AI Services, we cannot be held liable for temporary difficulties or impossibilities in accessing these Services that originate from external circumstances, in particular failures or limitations of our generative AI providers.

10. Specific Conditions for Services Involving the Upload of Documents

We offer Services involving the upload and storage of your Documents. These specific conditions apply to all Services requiring such an upload of Documents.

10.1. Ownership of Content

10.1.1. Manta acquires no intellectual property right over the Documents transmitted, including over content generated by generative artificial intelligence, with the exception of the rights strictly necessary for the proper functioning of the features involving the upload of Documents.

10.1.2. Where the features involve the storage of the Documents transmitted, Manta acts as a private host of the Documents within the meaning of the European Digital Services Act (DSA) and has no active role in, nor acquires knowledge of, the content you transmit. You are thus solely responsible for your use of the Services and undertake not to use these Services in a manner likely to infringe the rights of third parties.

10.2. Personal Data

If the Documents you transmit through the Services requiring an upload contain personal data, the Parties acknowledge that:

Manta will act as a processor in the context of the provision of the Services, since it acts in your name and on your behalf. In this respect, Manta undertakes to process your personal data only on documented instructions, in accordance with the data processing agreement appended to these GTC.
Manta will act as a data controller with regard to the other processing of personal data for which we determine the purposes and means, as described in the Personal Data Policy.

10.3. Liability and Warranties

10.3.1. You are responsible for the choice of the Documents uploaded to Manta and for the use made of the Services involving the upload and, where applicable, the storage of one or more Documents.

10.3.2. You warrant full and complete enjoyment of the Documents you transmit for the provision of the Services. In this respect, you undertake to transmit only Documents related to your profession. You attest that the uploaded Documents comply with the applicable legal and regulatory provisions and that you have obtained all the authorisations necessary for the use of the relevant Services.

10.3.3. Consequently, Manta may not be held, by virtue of an express or implied obligation, civilly liable for any direct or indirect damage arising from the use of the Services.

10.3.4. Subject to these reservations, Manta warrants that it holds all the rights necessary for the provision of the Services, and thus warrants the peaceful enjoyment of the Services involving the upload and, where applicable, the storage of the Documents.

10.4. Security of Your Documents

10.4.1. We undertake to ensure the security of the Documents transmitted. To this end, we implement technical and organisational measures meeting the highest level of the state of the art in cybersecurity.

10.4.2. We undertake to transfer and, for certain features, store the Documents only with providers meeting high physical and logical security guarantees. Our hosting provider AWS, whose servers are located in Paris, is certified ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019, 22301:2019, 20000-1:2018, 9001:2015, and CSA STAR CCM v4.0 and thus offers the highest physical and software security guarantees.

10.4.3. We have also deployed systematic encryption of every file stored on our servers using the AES-256 algorithm, which corresponds to the highest state of the art in encryption, and we authorise only secure HTTPS connections so that the communications are themselves encrypted.

10.4.4. We further warrant that your Documents are not transmitted to any third party other than our secure subcontractors necessary to carry out this service.

10.4.5. In order to ensure a high level of confidentiality for the Documents stored, we have put in place reinforced authentication measures to restrict access to the Documents to authorised Users only. To do this, each download of a Document involves the creation of a signed URL linked to the User making the request.

10.4.6. With regard to the generative AI features, we use generative AI models hosted in Europe, without transfer to the United States or to other third countries.

10.4.7. We do not use, except with your explicit agreement, your Documents or any other confidential information for the purpose of training our artificial intelligence systems.

10.5. Confidentiality Undertaking

10.5.1. By way of exception to Article 7.1, only the Engineering and Product teams working on the relevant Services may access files whose processing resulted in an error, for the sole purpose of correcting that error, or files whose processing is necessary to ensure the continuity of the Services.

10.5.2. You may notify us of your refusal that error correction be carried out, or ask us to delete files, by email at dpo@manta.fund or by using the features provided for this purpose on the Site.

10.5.3. In any event, the Documents stored are kept until an administrator of your Organization deletes them, or one year after the termination of its Subscription by your Organization.

11. Specific Conditions for Services Relating to Data Extraction

Data extraction works thanks to a type of algorithm that makes it possible to detect and identify elements within a Document. This algorithm scans the Documents to extract the data identified as necessary for completing the various pages of the Site.

No other aspect of your document is extracted or analysed. Our processing is, moreover, purely automatic and concerns only the recognition of words: your document is never subject to an analysis aimed at extracting or reusing its meaning.

12. Term of the Contract

12.1. It being specified that the contract applies to the use of the Site and to access to our Services through an Account, these GTC remain in force for as long as your Account is active.

12.2. The Subscription taken out under these GTC is independent of the term of the Contract that binds us. After termination of the Subscription, some of our respective obligations continue to apply. Apart from the payment obligation and the provision of the Services, our mutual commitments continue until the deletion of the Account.

12.3. Unless the Organization expressly requests the immediate deletion of the Accounts and of the data and Documents linked to them, their deletion will take place automatically one year after termination.

12.4. Only the Organization may request the deletion of an Account; a User may not request the deletion of their Account. They may, however, request the deletion of personal data in accordance with our Data Policy.

13. Miscellaneous

13.1. Assignment of the Contract

Manta may assign these GTC to an affiliated entity or in the context of a merger, a change of control or the sale of all or part of its assets, without your agreement, provided that (1) you are informed beforehand of this assignment; and (2) the assignee undertakes to comply with the obligations provided for in the GTC.

Subject to these conditions, the GTC will remain fully applicable to the Parties, as well as to their successors and assigns.

Neither such an assignment nor a change of control of Manta (within the meaning of the French Commercial Code) gives rise to any right of termination on your part.

13.2. Relationship Between the Parties

The Parties acknowledge that they act as independent co-contracting parties. These GTC create neither a partnership, nor a franchise, nor a joint venture, nor an agency relationship, nor a fiduciary relationship, nor a relationship of subordination.

13.3. Notices

All notices that we provide to you under these GTC may be sent in writing:

by post to the postal address you indicated on the Purchase Order;
by email to the email address you indicated on the Purchase Order.

You must send us your notices by post to the following address: 19, Rue des Archives, 75004, Paris.

Notices will be sent to the holder of the Subscription, namely the signatory of the purchase order. The Organization undertakes to pass on the notified information to all its Users.

13.4. Tolerance

No tolerance regarding the application of the provisions of the GTC may be interpreted as a waiver by Manta of its right to invoke them subsequently.

14. Updates

14.1. We reserve the right to modify, update or change the GTC at any time. Any modification will be communicated by any appropriate means fifteen (15) days before the entry into force of the new GTC. Any browsing after this period will be subject to the new GTC. For Team Subscriptions, the notice is addressed to the signatory of the purchase order. You may notify us, within this period, of your refusal of the new conditions, in which case the present conditions will continue to apply without modification.

14.2. The special conditions negotiated continue to apply for the duration of the initial Subscription, without prejudice to subsequent modifications of the GTC.

14.3. By way of exception to the foregoing and without prejudice to clause 5.1 relating to the change of price, updating the Contract to add conditions specific to new Services does not give rise to any possibility of refusal.

15. Dispute Resolution

We are always willing to consider an amicable solution before any legal action. In the event of legal action, the dispute will be subject to French law and to the jurisdiction of the Tribunal judiciaire de Paris or, failing that, the territorially competent French court.

16. Entry into Force

These general terms and conditions entered into force on December 5, 2025.

Appendix: Data Processing Agreement

This data processing agreement (hereinafter the “Data Processing Agreement”) governs the processing of personal data necessary for the provision of our Services involving the upload of Documents, as described in Article 2 of the GTC. This data processing agreement forms an integral part of the GTC.

The Parties acknowledge and accept that, with regard to the processing of personal data carried out for the provision of the Services involving the upload of Documents:

the Client acts as data controller;
Manta acts as processor.

1. Purpose of the Data Processing Agreement

The purpose of the Data Processing Agreement is to define the conditions under which Manta, as processor, undertakes to carry out the personal data processing operations on behalf of the Client.

2. Description of the Processing

Manta is authorised to process, on behalf of the data controller, the personal data necessary to provide the Services.

The nature of the processing: The collection, the processing and, where applicable, the storage of the Documents.
The purpose of the processing: To provide and ensure the continuity of the Services to Clients involving the upload of Documents by the Users.
The categories of personal data: Any personal data that may be contained in the Documents you upload for the purposes of the Services.
The categories of data subjects: Any data subject mentioned in the documents uploaded for the provision of the Services.

3. Manta’s Obligations

3.1. Processing of the Data

Manta undertakes to process the personal data only for the purpose that is the subject of the processing arrangement and in accordance with the documented instructions of the Client. If Manta considers that an instruction constitutes a breach of a legal or regulatory provision relating to the protection of personal data, Manta will inform the Client immediately.

If Manta is required to transfer data to a third country or to an international organisation, under the law applicable to the Data Processing Agreement, it undertakes to inform the Client of this legal obligation before processing, unless the law concerned prohibits such information for important reasons of public interest.

3.2. Confidentiality

Manta undertakes to guarantee the confidentiality of the personal data processed under this agreement.

To this end, Manta ensures that the persons authorised to process the personal data under this Data Processing Agreement are subject to a confidentiality undertaking and have received awareness training in the protection of personal data.

In addition, Manta undertakes to take into account the principles of data protection by design and by default in the design of the Services involving the upload of Documents.

3.3. Subsequent Subcontracting

Manta may use subcontractors (hereinafter “Subsequent Processors”) to carry out specific processing activities. In this case, it informs the Client in advance and in writing of any planned change concerning the addition or replacement of Subsequent Processors. This information must clearly indicate the subcontracted processing activities, the identity and contact details of the subcontractor and the dates of the subcontracting agreement. The Client has a minimum period of 5 working days from the date of receipt of this information to raise its objections. In the absence of opposition from the Client, it is deemed to have accepted the addition or replacement of a Subsequent Processor. In the event of an objection, Manta will liaise with the Client to determine whether the objection is justified. In the event of a justified objection, Manta will not use the Subsequent Processor concerned, leading to a deactivation of the Services requiring the use of that Subsequent Processor for the Client. The list of Manta’s Subsequent Processors is available in our Data Policy.

The Subsequent Processor is required to comply with the obligations of this agreement on behalf of and according to the instructions of Manta. It is for Manta to ensure that the Subsequent Processor provides the same sufficient guarantees as to the implementation of appropriate technical and organisational measures so that the processing meets the requirements of the European data protection regulation. If the Subsequent Processor fails to fulfil its data protection obligations, Manta remains fully liable to the Client for the performance by the Subsequent Processor of its obligations.

3.4. Transfers Outside the EU

Manta is authorised to transfer the personal data processed under the agreement to countries located outside the European Union, subject to the implementation of appropriate safeguards as defined in Chapter V of the GDPR.

3.5. Cooperation in Complying with the GDPR

Manta undertakes to assist the Client, as far as possible and reasonably, in carrying out a data protection impact assessment, in responding to a request to exercise rights and/or to a request made by a competent supervisory authority.

3.6. Information and Exercise of Data Subjects’ Rights

It is for the Client to provide information to the persons concerned by the processing at the time the data is collected. Where data subjects address requests to exercise their rights to Manta, Manta will forward these requests to the Client upon receipt.

3.7. Notification of Personal Data Breaches

Manta undertakes to notify the Client of any personal data breach within a reasonable time after becoming aware of it, accompanied by any useful documentation in order to allow the Client, if necessary, to notify this breach to the competent supervisory authority.

3.8. Documentation and Audit

Manta makes available to the Client the documentation necessary to demonstrate compliance with all of its obligations and to allow audits, including inspections, to be carried out by the Client or by another auditor it has mandated, and contributes to these audits.

3.9. Security Measures

Manta undertakes to implement the following security measures:

Measures for the pseudonymisation and encryption of personal data: encryption of data with the AES 256 algorithm at rest and TLS 1.2 in transit.
Means to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services: the personal data processed is hosted within the European Union by a highly secure hosting provider, AWS, certified ISO 27001/2013, 27017/2015, 27018/2019 and 9001/2015; Manta has established a Policy for access to the personal data processed, and an access review is carried out quarterly.
Means to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident: Manta has established a backup policy, as well as a business continuity and disaster response procedure; Manta carries out crisis simulation and backup restoration tests annually.
A procedure for regularly testing, analysing and evaluating the effectiveness of the technical and organisational measures for ensuring the security of the processing: Manta submits a replica of its Site to a penetration testing system in order to reveal any vulnerabilities. If vulnerabilities are discovered, Manta undertakes to resolve them according to the criticality of the vulnerability and to remunerate the researcher who identified the vulnerability. Manta carries out an annual internal audit to ensure that it complies with and maintains the security controls.

3.10. Fate of the Data

At the end of this Data Processing Agreement, Manta undertakes to automatically delete the personal data upon expiry of the Subscription, or to return it free of charge to the Client at its request, without keeping a copy, unless Union law or the law of the Member State requires the retention of the personal data.